Splunk Search

Windows Security events not getting forwarded

srinivas_gowda
Path Finder

Hello team,

 

I am trying to monitor windows event logs and have installed the universal forwarded with relevant data. I am getting the Application and System logs, however the Security events are not being forwarded. I am adding the inputs.conf details below please let me know what is causing this.

 


###### OS Logs ######
[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
# only index events with these event IDs.
whitelist = 16350-16400
index = default_tier1_idx
renderXml=false

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
# only index events with these event IDs.
whitelist = 0-10000
index = default_tier1_idx
renderXml=false

[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
# only index events with these event IDs.
whitelist = 7000-7050
index = default_tier1_idx
renderXml=false

 

Thank you

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

What user are you running your UF with? Local System? Or any other user?

Do you get any errors in your UF's log?

 

0 Karma

srinivas_gowda
Path Finder

Running this as a splunk user

Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. So you're using a designated user, created specificaly for the installation of UF, right? This user most probably does not have sufficient permissions to read the Security Event Log.

The easiest way to grant this user privileges to read all event logs is to add it to the "EventLog readers" local group. But it gives the rights to read ALL event logs which in your case might not be what you want. In order to selectively grant permissions to single event logs, you have to fiddle with registry entries and SDDL (ugly as hell, I admit) - https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/set-event-log-security-loc...

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...